Support ad-hoc protocol repositories outside the central registry

Discovery currently requires a repository to be listed in the central registry.yaml. Labs should be able to point an agent at a protocol repository directly — for private, pre-publication, or internal proprietary protocols — without central registration, the way a DuckDB client can ATTACH any Iceberg catalog.

The use case is sound and a federated standard should accommodate it. But this is a trust problem before it is a discovery problem, and the mechanism is the easy half.

Why it is a trust problem

ADR 0006 establishes that the unit of trust in the registry is the repository: trust_tier and approved_by are properties of a repository's registry entry, not of a protocol. An ad-hoc node has neither. So attaching one produces protocols that:

• have no trust_tier, which is the runner's primary ranking key (SKILL.md:36), and
• have no approved_by, i.e. no one has vouched for them at all,

while being merged into the same candidate list as vetted protocols (SKILL.md:30) and rendered in the same selection UI. A protocol is a set of instructions an agent will execute. Sourcing them from an unvetted location is a legitimate choice, but it must be a visible one.

Proposed

1. A configuration mechanism — an environment variable or a local file such as ~/.agent-protocols/config.yaml listing PROTOCOLS.yaml index URLs — documented in PROTOCOL_STANDARD.md and supported by protocol-runner.
2. Ad-hoc nodes are untrusted by construction. They are labelled as such wherever a protocol is presented for selection, and in the Method Provenance block, which is the artifact that ends up in a manuscript. "Unregistered source" is a provenance fact, not a footnote.
3. An ad-hoc protocol never outranks a registered one. Absent trust_tier must sort last, not sort as zero, absent, or undefined-and-therefore-arbitrary.
4. A registered protocol must not resolve a protocols_used dependency from an ad-hoc node. This is the important one. Dependency resolution matches on name, repository, and exact version (SKILL.md, step 4.2). If ad-hoc nodes join that resolution pool, attaching a repository that declares the right repository string lets it satisfy a trusted composite's dependency — silent substitution of an execution step, which is precisely what the runner's hard-filter and exact-version rules exist to prevent, reintroduced through a side door. Dependencies of registered protocols resolve only against registered nodes.

Depends on

waldronlab/agent-protocol-standard#22 — rules 3 and 4 are statements about trust_tier, which currently has no defined scale or direction. "Sorts last" is not expressible until "higher is more trusted" is written down.

Closely related to waldronlab/agent-protocol-standard#25 (private nodes are largely the same use case, reached over authenticated transport); kept separate because the trust-ranking question is independent of how bytes are fetched.

Start with PROTOCOL_STANDARD.md and the trust and dependency rules in SKILL.md, especially the references to registry.yaml, trust_tier, approved_by, and protocols_used. Trace the protocol-runner discovery and candidate-selection entry points, then check that the configuration, provenance, ranking, and dependency behavior are covered before treating the issue as done.